{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3accc_attestation_sigattested-tls-poc/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ccc_attestation_sig:attested-tls-poc:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-112377"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-112377\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["attested-tls-poc (\u003c= 731ca82)"],"_cs_severities":["high"],"_cs_tags":["cryptographic-vulnerability","tls-relay","attestation"],"_cs_type":"advisory","_cs_vendors":["CCC Attestation SIG"],"content_html":"\u003cp\u003eCVE-2026-112377 affects the CCC Attestation SIG attested-tls-poc library up to commit 731ca82. The vulnerability arises from an implementation flaw where early attestation evidence is not cryptographically bound to the resulting TLS connection. Because the evidence is loosely coupled with the session, an attacker who has managed to extract an attested TLS private key can perform relay or replay attacks. By intercepting a relying party's nonce and forwarding it to a legitimate, genuine attester, the attacker can force the attester to sign the nonce. The attacker then uses the resulting valid evidence to successfully impersonate the original, legitimate attested workload during a TLS handshake. This allows for unauthorized session establishment and potential interception of data intended for the genuine service. This flaw represents a critical failure in the intended security properties of remote attestation within this library.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains unauthorized access to the environment where the target workload resides.\u003c/li\u003e\n\u003cli\u003eAttacker extracts the attested TLS private key from the target application's memory or insecure storage.\u003c/li\u003e\n\u003cli\u003eAttacker intercepts a TLS handshake attempt between a relying party and the target workload.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a separate connection to a legitimate, genuine attester.\u003c/li\u003e\n\u003cli\u003eAttacker relays the relying party's original nonce to the genuine attester.\u003c/li\u003e\n\u003cli\u003eAttacker collects the resulting valid attestation evidence generated by the genuine attester.\u003c/li\u003e\n\u003cli\u003eAttacker completes the handshake with the relying party using the extracted private key and the replayed attestation evidence.\u003c/li\u003e\n\u003cli\u003eAttacker establishes a rogue TLS session, enabling data interception and impersonation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to impersonate an attested workload, effectively bypassing the security assurances provided by remote attestation. This leads to the potential for unauthorized data interception, manipulation, or man-in-the-middle attacks on the communication channels protected by the library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate update of the attested-tls-poc library. Ensure all deployments move beyond commit 731ca82 and apply any security patches provided by the CCC Attestation SIG to remediate CVE-2026-112377. Given the sensitive nature of these keys, perform an audit of secret storage and memory-protection policies for all workloads utilizing attested-tls-poc to prevent key extraction.\u003c/p\u003e\n","date_modified":"2026-10-19T20:23:05Z","date_published":"2026-10-19T20:11:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-attested-tls-relay/","summary":"The attested-tls-poc library fails to bind attestation evidence to TLS connections, enabling attackers to relay valid evidence to impersonate workloads and intercept sensitive data.","title":"CVE-2026-112377: Cryptographic Relay Vulnerability in attested-tls-poc","url":"https://feed.craftedsignal.io/briefs/2026-10-attested-tls-relay/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ccc_attestation_sig:attested-Tls-Poc:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}